Add principle 14: couple through data at rest, not run status

[JackKelly]

Stacked on #451 — targets intervention-log, so review that one first. The diff shown here is just this change.

The idea

Our production jobs don't really depend on each other. live_forecasts doesn't care whether ecmwf_ens succeeded in the last 24 hours, or whether this hour's telemetry pull ran — it selects the freshest NWP run genuinely present as of its own init time and stamps the row with how stale that was. A failed ingest makes the 06:00 forecast slightly staler. It cannot make it late, and it cannot make it absent.

The common alternative is a chain of scheduled jobs — A at 06:00, B at 06:15, C at 06:30 — where B's real input is the event of A having run. That design can't distinguish "A failed" from "A is still running" from "A had nothing to do", so one bad morning takes out everything downstream for the rest of the day.

Why this needed writing down

The property was already implemented, and already argued for in one place — f001982 dropped the promoted_model lineage edge from live_forecasts for precisely this reason. But the docs never stated the general rule, and two places framed it as a defect awaiting a fix:

• The power_time_series_and_metadata_schedule docstring called the :55 offset "a cheap mitigation, not a guarantee" and carried a TODO proposing a run-status sensor that would fire live_forecasts_job only once the ingest had succeeded.
• why-dagster-not-airflow.md listed "Sensors / run-status coordination" against "ingest → forecast ordering" as planned work.

Both describe a gate, and a gate turns one failed upstream run into a missing forecast — the exact failure mode Inherent Stability exists to prevent. An implementer following that TODO would have removed a load-bearing stability property while believing they were hardening it.

live_forecasts wants to run at 00/06/12/18 regardless, so there is no acceleration to be gained there anyway. Sensors are still wanted on the ingest assets, where they avoid booting a Fargate task just to discover there's nothing new to fetch — which is what #324 is actually for. The comparison-table row now says that instead.

Changes

• New principle 14 in design-principles.md, appended rather than inserted so no existing "principle N" citation moves.
• New rule 11 in inherent-stability.md, marked as restating a principle; preamble updated from "three of the ten" to "four of the eleven", and principle 1's "ten rules" link with it.
• schedules.py — TODO removed; both docstrings now say the decoupling is deliberate and why.
• operations.md and why-dagster-not-airflow.md — reworded off the "not a guarantee / fix still to explore" framing.

The asymmetry worth keeping in view

The lineage edge stays. Dagster still knows live_forecasts depends on ecmwf_ens and power_time_series_and_metadata, which is what lets a developer materialise one asset on a laptop and have its inputs built for them, and what keeps the graph legible in the UI. What we decline is letting that edge become a runtime precondition in production. Both the principle and the rule call this out explicitly, since it's the part most likely to be "tidied up" by someone later.

Verification

• uv run pytest — 395 passed, 1 skipped
• uv run ruff check / ruff format --check / uv run --all-packages ty check — clean
• uv run pymarkdown scan and uv run mkdocs build --strict — clean

[JackKelly]

Superseded by #454 — GitHub auto-closed this PR when its base branch intervention-log was deleted as part of merging #451. Same branch, same commits, rebased onto main.